ZAP Scan Baseline Report

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts
  • Absence of Anti-CSRF Tokens [10202] total: 12:
    • http://localhost:8080/bodgeit/basket.jsp
    • http://localhost:8080/bodgeit/login.jsp
    • http://localhost:8080/bodgeit/product.jsp?prodid=1
    • http://localhost:8080/bodgeit/product.jsp?prodid=10
    • http://localhost:8080/bodgeit/product.jsp?prodid=12
    • ..
  • Application Error Disclosure [90022] total: 5:
    • http://localhost:8080/docs/config/listeners.html
    • http://localhost:8080/docs/config/valve.html
    • http://localhost:8080/docs/jndi-datasource-examples-howto.html
    • http://localhost:8080/docs/jndi-resources-howto.html
    • http://localhost:8080/docs/manager-howto.html
  • Content Security Policy (CSP) Header Not Set [10038] total: 11:
    • http://localhost:8080/
    • http://localhost:8080/bodgeit
    • http://localhost:8080/bodgeit/
    • http://localhost:8080/bodgeit/about.jsp
    • http://localhost:8080/bodgeit/contact.jsp
    • ..
  • Missing Anti-clickjacking Header [10020] total: 11:
    • http://localhost:8080/
    • http://localhost:8080/bodgeit
    • http://localhost:8080/bodgeit/
    • http://localhost:8080/bodgeit/about.jsp
    • http://localhost:8080/bodgeit/contact.jsp
    • ..
  • Session ID in URL Rewrite [3] total: 1:
    • http://localhost:8080/examples/jsp/security/protected/j_security_check;jsessionid=61B1BF281D1CFF6644905E21BED49908
  • Source Code Disclosure - ActiveVFP [10099] total: 1:
    • http://localhost:8080/docs/ssi-howto.html
  • Source Code Disclosure - SQL [10099] total: 9:
    • http://localhost:8080/docs/
    • http://localhost:8080/docs/config/manager.html
    • http://localhost:8080/docs/extras.html
    • http://localhost:8080/docs/funcspecs/fs-jdbc-realm.html
    • http://localhost:8080/docs/funcspecs/fs-memory-realm.html
    • ..
  • Source Code Disclosure - Servlet [10099] total: 1:
    • http://localhost:8080/examples/jsp/jsptoserv/ServletToJsp.java.html
  • Application Error Disclosure [90022] total: 2:
    • http://localhost:8080/examples/jsp/error/err.jsp?name=ZAP&submit=Submit
    • http://localhost:8080/bodgeit/advanced.jsp
  • Cookie No HttpOnly Flag [10010] total: 2:
    • http://localhost:8080/bodgeit/basket.jsp
    • http://localhost:8080/examples/servlets/servlet/CookieExample
  • Cookie without SameSite Attribute [10054] total: 6:
    • http://localhost:8080/bodgeit
    • http://localhost:8080/bodgeit/
    • http://localhost:8080/bodgeit/basket.jsp
    • http://localhost:8080/examples/jsp/security/protected/
    • http://localhost:8080/examples/jsp/security/protected/index.jsp
    • ..
  • In Page Banner Information Leak [10009] total: 12:
    • http://localhost:8080/*.
    • http://localhost:8080/bin
    • http://localhost:8080/conf
    • http://localhost:8080/configure
    • http://localhost:8080/etc/init.d
    • ..
  • Information Disclosure - Debug Error Messages [10023] total: 1:
    • http://localhost:8080/bodgeit/advanced.jsp
  • Permissions Policy Header Not Set [10063] total: 11:
    • http://localhost:8080/
    • http://localhost:8080/bodgeit
    • http://localhost:8080/bodgeit/
    • http://localhost:8080/bodgeit/about.jsp
    • http://localhost:8080/bodgeit/contact.jsp
    • ..
  • Private IP Disclosure [2] total: 4:
    • http://localhost:8080/docs/config/filter.html
    • http://localhost:8080/docs/monitoring.html
    • http://localhost:8080/examples/jsp/snp/snoop.jsp
    • http://localhost:8080/examples/servlets/servlet/RequestInfoExample
  • X-Content-Type-Options Header Missing [10021] total: 11:
    • http://localhost:8080/
    • http://localhost:8080/bodgeit
    • http://localhost:8080/bodgeit/
    • http://localhost:8080/bodgeit/about.jsp
    • http://localhost:8080/bodgeit/contact.jsp
    • ..
  • Authentication Request Identified [10111] total: 3:
    • http://localhost:8080/examples/jsp/security/protected/j_security_check
    • http://localhost:8080/examples/jsp/security/protected/j_security_check;jsessionid=61B1BF281D1CFF6644905E21BED49908
    • http://localhost:8080/bodgeit/login.jsp
  • Content-Type Header Missing [10019] total: 2:
    • http://localhost:8080/docs/appdev/sample/sample.war
    • http://localhost:8080/examples/async/async2
  • Cookie Poisoning [10029] total: 2:
    • http://localhost:8080/examples/servlets/servlet/CookieExample
    • http://localhost:8080/examples/servlets/servlet/CookieExample
  • Information Disclosure - Sensitive Information in URL [10024] total: 1:
    • http://localhost:8080/examples/jsp/cal/cal1.jsp?action=Submit&email=zaproxy%40example.com&name=ZAP
  • Information Disclosure - Suspicious Comments [10027] total: 12:
    • http://localhost:8080/bodgeit
    • http://localhost:8080/bodgeit/
    • http://localhost:8080/bodgeit/about.jsp
    • http://localhost:8080/bodgeit/contact.jsp
    • http://localhost:8080/bodgeit/home.jsp
    • ..
  • Loosely Scoped Cookie [90033] total: 6:
    • http://localhost:8080/bodgeit
    • http://localhost:8080/bodgeit/
    • http://localhost:8080/bodgeit/basket.jsp
    • http://localhost:8080/examples/jsp/security/protected/
    • http://localhost:8080/examples/jsp/security/protected/index.jsp
    • ..
  • Modern Web Application [10109] total: 12:
    • http://localhost:8080/bodgeit/product.jsp?prodid=1
    • http://localhost:8080/bodgeit/product.jsp?prodid=10
    • http://localhost:8080/bodgeit/product.jsp?prodid=12
    • http://localhost:8080/bodgeit/product.jsp?prodid=16
    • http://localhost:8080/bodgeit/product.jsp?prodid=19
    • ..
  • Non-Storable Content [10049] total: 1:
    • http://localhost:8080/bodgeit
  • Session Management Response Identified [10112] total: 5:
    • http://localhost:8080/bodgeit
    • http://localhost:8080/bodgeit/
    • http://localhost:8080/examples/jsp/security/protected/
    • http://localhost:8080/examples/jsp/security/protected/index.jsp
    • http://localhost:8080/examples/jsp/security/protected/index.jsp
  • Storable and Cacheable Content [10049] total: 10:
    • http://localhost:8080/
    • http://localhost:8080/bodgeit
    • http://localhost:8080/bodgeit/
    • http://localhost:8080/bodgeit/about.jsp
    • http://localhost:8080/bodgeit/home.jsp
    • ..
  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 6:
    • http://localhost:8080/bodgeit/product.jsp?prodid=10
    • http://localhost:8080/bodgeit/product.jsp?prodid=10
    • http://localhost:8080/bodgeit/product.jsp?prodid=16
    • http://localhost:8080/bodgeit/product.jsp?prodid=16
    • http://localhost:8080/bodgeit/product.jsp?prodid=22
    • ..

View the following link to download the report. RunnerID:10315287396

---

ZAP is supported by the Crash Override Open Source Fellowship

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts

  • Information Disclosure - Debug Error Messages [10023] total: 1:

    • http://localhost:8080/bodgeit/advanced.jsp

    Resolved Alerts

  • SQL Injection [40018] total: 1:
  • Anti-CSRF Tokens Check [20012] total: 26:
  • Bypassing 403 [40038] total: 8:
  • Format String Error [30002] total: 2:
  • Insecure HTTP Method - PUT [90028] total: 452:
  • Relative Path Confusion [10051] total: 2:
  • XSLT Injection [90017] total: 2:
  • Cookie Slack Detector [90027] total: 201:
  • Cookie Slack Detector [90027] total: 11:
  • GET for POST [10058] total: 5:
  • User Agent Fuzzer [10104] total: 852:

View the following link to download the report. RunnerID:10349322455

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts

  • Information Disclosure - Debug Error Messages [10023] total: 1:

    • http://localhost:8080/bodgeit/advanced.jsp

    Resolved Alerts

  • SQL Injection [40018] total: 1:
  • Anti-CSRF Tokens Check [20012] total: 26:
  • Bypassing 403 [40038] total: 8:
  • Format String Error [30002] total: 2:
  • Insecure HTTP Method - PUT [90028] total: 452:
  • Relative Path Confusion [10051] total: 2:
  • XSLT Injection [90017] total: 2:
  • Cookie Slack Detector [90027] total: 202:
  • Cookie Slack Detector [90027] total: 11:
  • GET for POST [10058] total: 5:
  • User Agent Fuzzer [10104] total: 840:

View the following link to download the report. RunnerID:10381513197